The underlying curve, from Mike Hamburg, works over p = 2⁴⁴⁸ − 2²²⁴ − 1 with cofactor 4. Ed448 hashes with SHAKE256 and always prefixes a SigEd448 domain string and a context of 0–255 bytes; Ed448ph signs a 64-byte SHAKE256 digest instead of the message. Seeds and public keys are 57 bytes, signatures 114 bytes.
Identifiers: OID 1.3.101.113 (RFC 8410), JOSE OKP key with crv Ed448 and alg Ed448 (RFC 8037, RFC 9864), COSE −53 (RFC 9864), TLS 1.3 ed448 (0x0808) and native OpenPGP v6 keys (RFC 9580). FIPS 186-5 approves it. OpenSSH, WebCrypto and WebAuthn platform authenticators do not support it.
On one Apple M4 Max core, OpenSSL 3.6.5 makes about 27,500 Ed448 signatures and 10,100 verifications per second, roughly half the rate of Ed25519. Choose it when a policy asks for more than 128-bit classical security and every party supports it; for long-term protection, the post-quantum transition matters more than the step from 128 to 224 bits.